Quantum secret sharing between m-party and n-party with six states 
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We propose a quantum secret sharing scheme between m-party and n-party using three conjugate 
bases, i.e. six states. A sequence of single photons, each of which is prepared in one of the six 
states, is used directly to encode classical information in the quantum secret sharing process. In 
this scheme, each of all m members in group 1 choose randomly their own secret key individually 
and independently, and then directly encode their respective secret information on the states of 
single photons via unitary operations, then the last one (the mth member of group 1) sends 1/n 
of the resulting qubits to each of group 2. By measuring their respective qubits, all members in 
group 2 share the secret information shared by all members in group 1. The secret message shared 
by group 1 and group 2 in such a way that neither subset of each group nor the union of a subset 
of group 1 and a subset of group 2 can extract the secret message, but each whole group (all the 
members of each group) can. The scheme is asymptotically 100% in efficiency. It makes the Trojan 
horse attack with a multi-photon signal, the fake-signal attack with EPR pairs, the attack with 
single photons, and the attack with invisible photons to be nullification. We show that it is secure 
and has an advantage over the one based on two conjugate bases. We also give the upper bounds of 
the average success probabilities for dishonest agent eavesdropping encryption using the fake-signal 
attack with any two-particle entangled states. This protocol is feasible with present-day technique. 

PACS numbers: 03.67.Dd; 03.67.Hk; 89.70.+C 



I. INTRODUCTION 

Secret sharing is a powerful technique in computer sci- 
ence, which enables secure and robust communication 
in information networks, such as the internet, telecom- 
munication systems and distributed computers. The se- 
curity of these networks can be enhanced using quan- 
tum resources to protect the information. Such schemes 
have been termed quantum secret sharing. There are 
many kinds one-to-multi-party quantum secret sharing 
schemes, such as with entangleme nt fH , d, H, 13, H, S S H 
[H, [l(| and without entanglement The basic idea of 
secret sharing in the simplest case is that a secret of one 
person, say Alice, is shared between other two persons, 
say Bob and Charlie, in such a way that it can only be 
reconstructed if both collaborate. In a more general case, 
notably for secure key management, a t-out-of-n proto- 
col (or (t, n)-threshold scheme) with 1 < t < n spreads a 
secret to n participants in a way that any t participants 
can reconstruct it [12| . Lance et al. have reported an ex- 
perimental demonstration of a (2,3) threshold quantum 
secret sharing scheme [l3| . The interesting aspect of ex- 
ploring quantum mechanics for secret sharing is that it 
allows for unconditionally secure distribution of the in- 
formation to the participants. 

In Ref . 1] , Hillery et al. proposed one-to-two-party and 
one-to-three-party secret sharing schemes via maximally 
entangled three-particle and four-particle states, respec- 
tively. Xiao et al. jsj reformulated the protocol Q in a 
simple mathematical terms and generalized the protocol 
into arbitrary number parties case. The main pur- 



pose of Ref. [f| is to show that it is also possible to realize 
secret sharing as in Ref. [l[ with two-particle quantum en- 
tanglement. At the same time, Karlsson et al. Q also 
presented a detailed discussion of how to detect eaves- 
dropping, or how to detect a dishonest party in the pro- 
tocols. Quantum secret sharing protocol provides for se- 
cure secret sharing by enabling one to determine whether 
an eavesdropper has been active during the secret sharing 
procedure. But it is not easy to implement such multi- 
party secret sharing tasks [H, H, [§] , since the efficiency of 
preparing even trip artite or four-partite entangled states 
is very low [3, Il5j . at the same time the efficiency of the 
existing quantum secret sharing protocols using quan- 
tum entanglement can only approach 50%. Recently, a 
scheme for quantum secret sharing without entanglement 
has been proposed by Guo and Guo [ll[ . They presented 
an idea to directly encode the qubit of quantum key dis- 
tribution and accomplish one splitting a message into 
many parts to achieve one-to-multi-party secret sharing 
only by product states. The theoretical efficiency is dou- 
bled to approach 100%. 

In the modern society, signatures on documents, au- 
thentications, encryptions, and decryptions are often 
needed by more than one person, especially by all per- 
sons of two groups. Therefore, the secret sharing between 
many parties and many parties is indeed required. The 
advantage of secret sharing between many parties and 
many parties is that honest agents can keep the dishon- 
est ones from doing any damage when they appear in 
the process for business. More recently, we suggest a 
quantum secret sharing scheme employing two conjugate 
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bases, i.e. four states, of single qubits to achieve the se- 
cret sharing between multi- par ty and multi-party with a 
sequence of single photons [la]. Deng et al. |17| an d Li 
et al. [18] showed the weakness of our protocol [l6j] . We 
proposed an improved protocol [191 ] , which can avoid the 
flaws and is secure against the attack with invisible pho- 
tons [2(| and the fake-signal attack with any two-particle 
entangled states (the special case of which is the fake- 
signal attack with EPR pairs [2l|). 

In this paper, we propose a quantum secret sharing 
scheme between m-party and n-party by using three 
rather than two conjugate bases. In this scheme, all m 
parties in group 1 select their own secrets individually 
and independently, and split their respective secret in- 
formation among the whole group 2 (n parties) in such 
a way that neither part members of either group 1 or 
group 2 nor the union of a subset of group 1 and a subset 
of group 2 has any knowledge of the combination of all 
senders (group 1), but only by working together can all 
members of each group jointly determine what the com- 
bination of all senders (group 1) is. In this case it is the 
secret information of each person in group 1 that has been 
split up into n pieces, no one of which separately contains 
the original information, but whose combination does. 
We show that this m-to- n-party scheme is more secure 
than the one in 0, [l9[ based on two conjugate bases, 
i.e. four states, such as its security against the Trojan 
horse attack 17], the two attacks stated in Ref. [Hj], the 
attack with invisible photons [2(j, and the attack with 
EPR pairs [2l| . In fact, we show that this protocol is 
secure against more general attack (the attack with any 
two-particle entangled state) than the attack with EPR 
pairs. The advantage of the present scheme is that two 
honest agents, one in group 1 and the other in group 2, 
can keep the dishonest ones ( other m + n — 2 members) 
and the m + n + 1 party (an 'external' Eavesdropper, 
Eve) from doing any damage. That is, this protocol is 
secure as long as there is one agent at each group being 
honest. Comparing with the efficiency 50% limiting for 
the existing quantum secret sharing protocols with quan- 
tum entanglement, the present scheme can also be 100% 
efficient in principle. 



II. QUANTUM KEY SHARING BETWEEN 
MULTI-PARTY AND MULTI-PARTY BASED ON 
SIX STATES 

Let Alice 1, Alice 2, Alice rn, and Bob 1, Bob 
2, • • • , Bob n be respective all members of group 1 and 
group 2. m parties of group 1 want quantum key sharing 
with n parties of group 2 such that neither part of each 
group nor the union of a part of group 1 and a part of 
group 2 knows the key, but only all members of each 
group can collaborate to determine what the string (key) 
is. Next we put forward an m-to- n-party quantum secret 
sharing scheme by using of three conjugate bases, or six 
states, to achieve the aim mentioned above — the secret 



sharing between m parties and n parties. Let us see how 
this works in detail. 

Ml. Alice 1 creates a random nN bit string A\ and a 
random nN trit string B\ , where a\ and b\ are uniformly 
chosen from {0,1} and {0,1,2}, respectively. She then 
encodes these strings as a block of nN qubits (nN single 
photons), 
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where a\ is the fcth bit of A\ (and similar for B\). Each 
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is in one of the six states 
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The value of b\ determines the basis 
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If b\ is then a\ 

is encoded in the Z basis {|0), |1)}; if b\ is 1 then a\ is 
encoded in the X basis {|+), |— )}; if b \ is 2 then a\ is 
encoded in the Y basis {| + y), | — y)}. Note that the 
six states are not all mutually orthogonal, therefore no 
measurement can distinguish between all of them with 
certainty. Alice 1 then sends the sequence of nN single 
photons to Alice 2 over their public quantum communi- 
cation channel. 

M2. When Alice 2 receives the nN qubits, she chooses 
randomly a large subset of photons as the samples for 
eavesdropping check. First, she uses a special filter to 
prevent the invisible photons from entering the operation 
system, splits each sample signal with a photon number 
splitter (PNS: 50/50), and then measures each signal in 
the measurement basis (MB) Z, or X, or Y at random. 
Obviously if two or more photons in one signal are de- 
tected, then Alice 2 aborts the communication. More- 
over, she analyzes the error rate e s of the samples by 
requiring Alice 1 to tell her the original states of the 
samples. If the error rate is hi ghe r than the threshold 
chosen by all Alices and Bobs [24|, Alice 2 aborts the 
communication, otherwise she goes ahead. After Alice 2's 
checking, the number of the remaining unchecked qubits 
(photons) must be less than nN. However, for conve- 
nience, we suppose that Alice 2 still has the nN photons. 

Alice 2 selects two random niV-trit strings A 2 and B 2 . 
She performs the operation cfq = I = |0)(0| + |1)(1|, 
a x = ia y = |0)<1| - |1)(0| or a 2 = a z = |0> <0| - |1)(1| on 
each qubit |^> a i&i) if the corresponding trit value a\ of 
A2 is 0, 1 or 2, respectively. Then, she applies a unitary 
operator U — I, Ui — -*-(|0) + |1»(0| - ^(|0> - |l»(lj, 

or U 2 = ^(|0) + i|l))(0| + ^(|0) - i|l))(l| on the fcth 

photon depending on b\ = 0, 1, or 2, respectively. We 
denote each of the resulting qubit states as \ijj a 2 b 2). After 
that, Alice 2 inserts randomly N 2 decoy single photons 
into nN photons encoded by her, where each of the de- 
coy single photons is randomly in one of the states in 
Eq.©. Then she sends Alice 3 the resulting (nN + N 2 )- 
qubit state |^ 2 ) = Ojjf^ 2 \^a 2 k bl )■ Notice that \ip a z b 2) 
is determined by a\,b\,a\,b\. 
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The nice feature of the unitary transformations 
ia y ,a x ,a z is that they leave bases Z, X and Y un- 
changed, and each of them flips the states in two mea- 
surement bases. For example, o\ = ia y flips the states in 
both bases X and Z such that 

ai|0) = -|l) > o-ijl) = |0), 

<ri|+> = |->, a l \-) = -\+). W 

The operators U\ and U2 cyclically permute the three 
bases Z, X and Y such that 

U, : {|0>, |1)} - {|+>, |_)} - {| + l/ >, | - {| ), |1)} 

(4) 

and 

U 2 : {|0),|1)}^{|+»),|-i/>}-^{|+),|-)}^{|0),|1)}. 

(5) 

M3. Alice i (3 < i < to) operates the qubits like Alice 
2 docs. That is, first, she select a large subset of photons 
at random as the samples for eavesdropping check. For 
determining the error rate of the samples, all the mem- 
bers before Alice i must tell Alice i the original state or 
the operations they chose in a random sequential order. 
Because of nice feature of the unitary transformations 
i<Jy, a x , a Zl U\, U2, each qubit \ip a ij,i) of the resulting 

nN + Ni-i qubit product state <8>fc=i +Ar, ~ 1 IVVbO 1S tnc 
eigenstate of a z , a x , or a y if [b\ + b\ + - ■ • + 6|)mod3 = 0, 
1, or 2, respectively. Evidently, \ip i b i) is govern by 

k k 

a fe> a fe.-" > a k' b h b k>--- ,b\- Here « = 3,4,- ,m. Sec- 
ond, Alice i generates two random (nN + A^_i)-trit 
strings A4 and Bi, applies ao, or a i on the A:-th pho- 
ton depending a\ = 0, 1, or 2 and performs C/qj Ui, or 
[72 on the resulting state of the fc-th photon according to 
b\ = 0, 1, 2. Finally, Alice i inserts randomly Ni — A^_i 
decoy single photons into nN + Ni-i photons encoded 
by her. 

M4. Alice i (3 < i < to— 1) sends the resulting nN+N 
qubit product state = <S>^^ Ni iVVfc* ) to Alice i + 1. 
Without loss of generality, we can suppose that nN + 
N m = nN (Alice to can manage it). Alice to sends N- 

qubit product states |4f ) = ®jL" Va™. +1 6- +1 ), |*?) = 

^jToV^^J: l*n) = <=oV<C 3+ „^ + J Of 

the resulting nA-qubit state |* m ) = ®t=i\i) a ™b™) to 
Bob 1, Bob 2, • • • , Bob n, respectively. 

M5. When all Bob 1, Bob 2, • • • , and Bob n have 
received their respective nN qubits, each of them first 
randomly and independently chooses enough photons as 
samples and measures each of them in MB Z, or X or Y 
at random. Then they ask Alice 1, Alice 2, • • • , and Alice 
to to announce publicly the a\ and b\ of the samples in a 
random sequential order. Here h± is the label of the sam- 
ple chosen for eavesdropping check, and i — 1, 2, ■ • • ,to. 
After that Bobs publish their measurement outcomes and 
the measurement bases. All Alices and Bobs discard all 
check photons except those for which Bobs measured in 
the MB Z, X or Y according to (E™i 6 fc t ) mod3 = °, 



1 or 2, and compare the values of their remaining check 
photons. If the error rate of the remaining samples is 
reasonably less than a threshold, then they continue to 
the quantum communication. Otherwise they abort it. 

M6. Alice 1, Alice 2, • • • , and Alice m ask all Bobs to 
discard the decoy photons that are not chosen for eaves- 
dropping check, and then publicly announce the strings 
B\, £>2, and B m at random, respectively. Bob 1, 
Bob 2, • • • , and Bob n then measure each qubit of their 
respective strings in MB Z or X or Y according to the 
result of addition modulo 3 of corresponding trit values of 
strings B x , B 2 , ■ ■ ■, B m . Thus, if (X^i &^ +i )mod3 = 0, 
then Bob I measures \ib n m h m ) in the Z basis; if 
(SHi b nj+i) m °d3 — lj he measures in the X basis; if 
(SHi b nj+i) m °d3 = 2, he measures in the Y basis. After 
his measurement, Bob I can extract out the combination 
of all Alices's encoding information. 

Let measurement result of Bob I be Ci = {cnj+j}^ 1 
and the combination of all Alices's encoding information 

be A = {ak}k=n where at is determined by all a\ and 
&|, and ak and c n j+i are or 1, corresponding to the +1 
and -1 eigenstates of cr 2 , a Xl and a y . Clearly, if there are 
no eavesdropper and noise, there must be c n j + i — a n j+i. 
Here I — 1, 2, • • • ,n and i = 1, 2, • • • , m. 

M7. All Alices and Bobs perform some tests to deter- 
mine how much noise or eavesdropping happened during 
their communication. Alice 1, Alice 2, • • • , and Alice m 
select some photons nj r + 1 (of their nN photons) at ran- 
dom, and publicly announce the selection. All Bobs and 
all Alices then publish and compare the values of these 
checked bits. If they find too few a n j r -\-i = c n j r+ i, then 
they abort and re-try the protocol from the start. 

M8. The XOR results ®f =1 c njs+ i of Bob Vs cor- 
responding bits c n j g j r i of the rest unchecked photons 

nj^+l of ®Jj 1 \i> a ™ +lbz+1 ), < = "oVa™ +2 c j+2 >, 

®f=o 1 \' i l Ja ^ j+n b Z)+^ can De useo - as raw keys for secret 
sharing between all Alices and all Bobs. 

Remark 1. It is necessary for Alice 2, Alice 3, • • • , Alice 
to make a eavesdropping check before they operates the 
photon signals, otherwise dishonest agent Alice io can 
obtain secret messages of Alice io + 1, • ■ • , Alice to with 
a Trojan horse attack and invisible photons attack. The 
reasons are similar to that stated in Ref . [13, HH . 

Remark 2. By random sampling in M5, the security 
flaw indicated in (l8j can be avoided in the present pro- 
tocol. That is, for this protocol, the two types attacks, 
the attack with EPR pairs and the attack with single 
photons, proposed in [18| are of no effect. The reason is 
as follows. Evidently, Bobs' measurements collapse the 
check samples into the states of a single particle. That 
is, all Bobs' measurements remove the entanglements be- 
tween check photons and other eavesdropping particles, 
which correspond to that the attacker Alice i$ sends Bobs 
single quantum states Eq. Q whether in the attack with 
EPR pairs or the attack with single photons. Appar- 
ently, we can find out the attacker in the attack with 
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single photons via Alices' publishing their respective en- 
coding information in a random sequential order. Since 
Bob I asks Alices to announce the a\ and bj, in a ran- 
dom sequential order, the attacker will not be the last one 
to answer the Bob I's enquiry with a probability If 
there is a Alice to be asked after the attacker Alice io, Al- 
ice io can not distinguish the quantum state intercepted 
by her with certainty, and can only guess a]° and b l £ to 
answer the inquiry. It is not difficult to deduce that the 
error rate of the samples that Bobs measured in MB Z, 
X, or Y corresponding to (YliLi b\ t )mod3 = 0, 1, or 2 is 
more than 2|pi. 

2 m 

Remark 3. It is very nice that this scheme can make the 
fake-signal attack with any two-particle entangled state 
(the special case of which is the fake-signal attack with 
EPR pairs [2l|) to be nullification. The argument goes 
as follows: 

Suppose that the eavesdropper Alice io (who could be 
any dishonest one of Alices) generates nN + Ni general 



EPR pairs in the state 



nN+N i0 



Here 



I** 



|*) = \0) A \a) E 



ID 



(G) 



- Ni qubit A to Alice io + 1 



\a) e and |/3) e are unnormalized states of the iS-level (S > 
2) particle E. Note that the special case of is an EPR 
pair (when (a\f3) = {(3\a) = 0, (a\a) = (/3|/3) = ±, |* fc ) = 
|\&) is an EPR pair). Alice io keeps the second particle 
E of each \^k), replaces the original single photons in 
the state l^ 10 ) with the first particle A of each \^k) and 
sends the sequence Sa of nN - 
(this is a more general situation than that in [S 

If |^>) is not a two-particle maximally entangled state 
(EPR pair), then Alice io can not but makes mistakes in 
M2 (if i = 1) or M3 (if i > 1), because Alice i can not 
distinguish between |a) and \0), between \a) + \0) and 
\a) — |/3), and between |a) + i|/3) and \a) — i|/3) perfectly. 
Thus Alice io + 1 can detect the cheating of Alice io m 
M2 (if io = 1) or M3 (if io > 1)- Next we only assume 
that |*) is an EPR pair. Alice io + 1 in the step M2 
(if io = 1) or M3 (if io > 1) cannot detect this cheating 
as Alice io is able to produce no errors in the results if 
Alice io is asked to announce her encryption a\° and b l ° 
of the samples after Alice 1, • • • , Alice io — 1- But if Alice 

10 is not the last to announce her encoding information, 
then her cheating introduces errors and can be found out 
by Alice io + 1 in M3 (if io > 1) without fail. However, 
when the dishonest Alice io is Alice 1, this cheating of her 
cannot be found out by Alice 2 as it does not introduce 
errors in the results. 

Alice 1 intercepts Sa while it was sent to Alice i\ (2 < 

11 < in) or Bobs (if Alice 1 never intercepts Sa, then 
she can not obtain any information, although this kind 
of eavesdropping can not be found in the eavesdropping 
check. So it does not make any sense for Alice 1 to do 
this kind of eavesdropping ). 

The object of Eve is to obtain all Alices' encoding in- 
formation Ai and Bi. In order to achieve this purpose, 
Alice 1 must manage to distinguish nine unitary opera- 
tions cr , cti, cr 2 , Ui, Uidi, U\(J2, U 2 , U 2 fJi, and U 2 a 2 (if 



ii = 3) or more than these nine operations (if ii > 4). 
That is, Alice 1 must manage to distinguish the following 
9 states 



|*) = |0)H + |l)|/3), 
* 1 \*) = -\l)\a) + \0)\fl, 



\xi) 

1X2) 

|X3>=<7 2 |*>= 0)|,.)-|1) >) 
|X4 



U 1 \*) = ±(\0) + \l))\a)--j=(\0)-\l))\P), 
\ X6 ) = Ura^) = -±=(| ) - |l»|a) + -^(|0) + |1»|/J>, 
\ X6 ) = U^) = -L(|0) + |1»|«> + ^=(|0) - |l))|/3), 

ixr) = ^ 2 |*> = i(io) + i|i»ia> + i(io) - mm, 

Ixs) = ^1*) = ~(\0) i\l))\a) + -J=(|0) + 
|X9) = U 2 a 2 \V) = -L(|0) + i|l»|a) - -L(|0) - 



(7) 



or even more, where ai and UiUi act on the first parti- 
cle, and 1^) is an EPR pair. These states belongs to the 
four dimension subspace W of the entire Hilbert space 
H spanned by |0)|a), |0)|/3), |l)|a) and \l)\f3), and it is 
impossible for more than four states being mutually or- 
thogonal, therefore these states can not be reliably distin- 
guished [2J|. Thus Alice l's eavesdropping can be found 
in M3 by Alice i\ or in M5 by all Bobs. Therefore the 
present quantum secret sharing protocol is secure against 
the fake-signal attack with any two-particle entangled 
state (the special case of which is EPR pairs). 

On the other hand, in the present protocol, Alices in- 
sert randomly decoy single photons into the signal pho- 
tons in M2 or M3. The eavesdropping check on the decoy 
single photons is the same as that on the signal photons. 
That is, first Alice i measures (or all Bobs measure) each 
decoy single photon in MB Z, X or Y at random, then 
she asks (they ask) Alice 1, Alice 2, • ■ • , Alice i — 1 (all Al- 
ices) to tell her (them) their encoding information a*, b\ 
of the samples in a random sequential order. Note that 
there is at least one honest agent in one communication 
group. Therefore the dishonest agent can be found by 
the eavesdropping checks on the decoy photons by the 
honest agents. The principle of the checking procedures 
is the same as that in six states quantum key distribution 
protocol [Hill]. 

Next we give the upper bounds of the average success 
probabilities of two cases. 

Case I. The upper bound of the average success proba- 
bility distinguishing the nine states in Eq.®, where \^>) 
is a general two-particle entangled state. Since the non- 
orthogonal states can not be reliably distinguished [24| . 
distinguishing the nine states is equivalent to find \a) and 
1/3) such that 



(XilXi) 



(8) 
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However, there are no \a), \(3) satisfying Eq.©, as even 
there are no |a), \ j3) satisfying the following equations 



(Xi|X2> = H3)-(/3|a)=0, 
(Xi\X3) = (a\a)-(P\/3)=0, 



(9) 
(10) 



(xi\X4) = -j=(l + ±)(a\a) - -J=(l - ±){a\0) = 0, (11) 



(Xilxs) = -^<a|a>--^<a|/3)--^C9|a)+-^C9|)9) = 0. 

Thus, Eve can not reliably distinguish the nine states in 
Eq.([7|). 

We calculate the upper bound of the maximal suc- 
cess probability for Eve unambiguously discriminating 9 
states in Eq.f7|). Let 
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a, 



x + xy, 



a\a) = z, 
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then 



\a) = x- ly, 



z > 0, t > 0, z + i = — , 
v2 
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By simply calculating, we obtain that 
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E KXik*>l>27. 



(13) 



(14) 



(15) 



(16) 



Moreover, the equality holds if 
£ = y = 0, t = z 



2\/2' 



(17) 



That is, the minimum of j—i \ (xi\Xj) \ occurs at 



(a\0)=O,(a\a) = <J3\0) 



(18) 



The average success probability Pi [27J for unambigu- 
ous identification of the nine states in Eq.® is 



Case II. The upper bound of the average success prob- 
ability classifying the following three sets 



{|Xn}> IX12), IX13)}, 
{IX21), IX22), IX23)}, 

{|X3l), |X32), |X33)} 

for gaining secret information Ai, where 



(20) 



Ixn) 


= Ixi), IX12) 


= |X4), |Xl3) 


= 1X7), 


IX2l) 


= 1x2), IX22) 


= |X5), |X23) 


= Ixs), 


IX3l) 
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= Ixe), IX33) 


= 1X9). 



It is not difficult to derive 
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A little thought shows that 

The equality occurs at 

(a|/3)=0,(a|a) = (/3|/3) = i (24) 

The average success probability Pi of conclusive quan- 
tum states sets classification [28| is 

P 2 <l-H- (25) 

From Eq. (fi"9|) and Eq. ([25|l , we can see that Eve can not 
deduce Ai and -Bi by the probability more than |. Thus, 
no matter what kind strategy the malicious Alice «o use, 
she will disturb the quantum system, make mistakes, and 
therefore can be detected in M2, M3, M5, or M7. There- 
fore not only the fake-signal attacking with EPR pairs 
but also the fake-signal attacking with any two-particle 
entangled states — general EPR pairs can not work for 
the quantum secret sharing protocol with the six states. 

Note that Eve can not deduce Ai and Bi by the prob- 
ability more than | by Eq.(15) and Eq(19) in [l9|], but 
in the present protocol, for getting all Alices' encoding 
information Ai and Bi, Eve must manage to distinguish 
nine states in Eq.([7]) or even more. It implies that this 
quantum secret sharing scheme between multi-party and 
multi-party with six states is much more secure than that 
with four states in [l6|, [l9[ . 

Remark 4. For safety, Alice 2, Alice 3, • • • , Alice to 
must utilize at least three of /, a x , i<7 y , and a z to en- 
code their secret message. If they use two, then | secret 
information will be leaked. 

Remark 5. Alice i (2 < i < m) applying unitary op- 
eration C/i or C/2 randomly on some qubits is to achieve 
the aim such that no one or part of Alice 1, • • • , Alice 
to can extract some information of others [161 ] . 

Remark 6. This protocol is safer than that with four 
states [lllllll, which can also be shown in section III. 

This secret sharing protocol between m parties and n 
parties is almost 100% efficient as all the keys can be used 
in the ideal case of no eavesdropping, while the quantum 
secret sharing protocols with entanglement states [l[ can 
be at most 50% efficient in principle. In this protocol, 
quantum memory is required to store the qubits which 
has been shown available in the present experiment tech- 
nique [29j . However, if no quantum memory is employed, 
all Bobs measure their qubits before Alice i's (1 < i < m) 
announcement of basis, the efficiency of the present pro- 
tocol falls to 33.33%. 



III. SECURITY 

By means of the special filters, photon number split- 
ters, single-photon detectors, the eavesdropping check of 



each member Alice i (i = 2, 3, • • • , m) in group 1, insert- 
ing of decoy states in M2 and M3, unitary operations in 
M2 and M3, and the random measurements of all Bobs 
on their respective qubits chosen at random, either an 
(m + n + l)-th party (an "external" eavesdropper) or the 
dishonest agent of two groups can be found by the honest 
agents. Therefore all Alices and all Bobs must be honest. 

The encoding of secret messages by Alice i (1 < i < m) 
is identical to the process in a one-time-pad encryption 
where the text is encrypted with a random key as the 
state of the photon in the protocol is completely random. 
The great feature of a one-time-pad encryption is that as 
long as the key strings are truly secret, it is completely 
safe and no secret messages can be leaked even if the 
cipher-text is intercepted by the eavesdropper. Here the 
secret sharing protocol is even more secure than the clas- 
sical one-time-pad in the sense that an eavesdropper Eve 
can not intercept the whole cipher- text as the photons' 
measuring-basis is chosen randomly. So the transmission 
of qubits between authorized members in the two groups 
is secure. Thus the security of this secret sharing protocol 
depends entirely on the second part when Alice to sends 
the Z-th sequence of N photons to Bob I (1 < I < n). 

The process for ensuring a secure block of nN qubits 
(n secure sequences of N photons) is similar to that in 
quantum key distribution protocol based on six quan- 
tum states [25], [1^1 , in the following called BBB WB six- 
state protocol. The process of this secret sharing be- 
tween to parties and n parties after all Alices encoding 
their respective messages using unitary operations is in 
fact identical to n independent BBBWB six-state proto- 
col processes, which has been proven unconditional se- 
cure [3(J. Lo [3(| has demonstrated the unconditional 
security of BBBWB six-state protocol up to a bit error 
rate of 12.7 percents, by allowing only one-way classical 
communications in the error correction/privacy amplifi- 
cation procedure between Alice and Bob. This shows a 
clear advantage of the six-state protocol over BB84 [3lj . 
which has been proven to be secure up to 11 percents, if 
only one-way classical communications are allowed. Lo 
[3(J | has shown that an advantage of the six-state protocol 
lies in the Alice and Bob's ability to establish rigorously 
from their test samples the non-trivial mutual informa- 
tion between the bit-flip and phase error patterns. Thus 
the security for the present quantum secret sharing be- 
tween multi-party and multi-party is guaranteed. 

In summary, we propose a scheme for quantum secret 
sharing between multi-party and multi-party with three 
conjugate bases, or six states, where no entanglement is 
employed. In the protocol, Alice 1 prepares a sequence 
of single photons in one of six different states accord- 
ing to her two random classical strings, other Alice i 
(2 < i < to) directly encodes her two random classical in- 
formation strings on the resulting sequence of Alice (i— 1) 
via unitary operations, after that Alice to sends 1/n of 
the sequence of single photons to each Bob I (1 < I < n). 
Each Bob I measures his photons according to all Alices' 
measuring-basis sequences. All Bobs must cooperate in 
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order to infer the secret key shared by all Alices. Neither 
a subset of either all Alices or all Bobs nor the union of 
a subset of all Alices and a subset of all Bobs can extract 
secret information, but each entire group (each of the en- 
tire set of all Alices and the entire set of all Bobs) can. 
This scheme has no secure flaws proposed in [T3] and flU . 
It is secure against the attack with invisible photons [20| 
and the fake signal attack with any two-particle entan- 
gled state (the special case of which is the attack with 
EPR pairs [2l|). and safer than the one 0, based 
on two conjugate bases, i.e. four states, which is secure. 
This shows the advantage of our proposed scheme based 
on six states over Ref.[lj|. As entanglement, especially 
the inaccessible multi-party entangled state, is not nec- 
essary in the present quantum secret sharing protocol 



between m-party and n-party, it may be more applicable 
when the numbers m and n of the parties of secret shar- 
ing are large. Its theoretic efficiency is also doubled to 
approach 100%. This protocol is feasible with present- 
day technique. 
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